Managing Users in macOS via Terminal

macOS is UNIX-based, so you can use standard BSD commands like dscl (Directory Service Command Line) for managing users in macos and groups as well. The reason I found this useful is that you can remote using SSH to any mac and make this changes. You don’t need to rely on the GUI. Especially if you’re connecting from a different OS such as Windows or Linux.

Some of these commands require sudo because they modify system accounts. Before I tested these I had to brew a nice Sidra coffee variety at home using my Moka pot.

Check existing users

dscl . list /Users

Means the local directory (your Mac).
This lists all user accounts (system + human).

Add a new user

Create a local user paco with a home directory.

sudo sysadminctl -addUser paco -fullName "Paco Raban" -password "Secret123"

Creates the user paco.
fullName sets the display name.
password sets the login password.
Automatically creates /Users/paco.

Another way with dscl (more manual way):

sudo dscl . -create /Users/john
sudo dscl . -create /Users/john UserShell /bin/bash
sudo dscl . -create /Users/john RealName "John Doe"
sudo dscl . -create /Users/john UniqueID 501
sudo dscl . -create /Users/john PrimaryGroupID 20
sudo dscl . -create /Users/john NFSHomeDirectory /Users/john
sudo dscl . -passwd /Users/john Secret123
sudo createhomedir -c -u john

Note: UniqueID must be unique (start from 501 upward for normal users).

Remove a user

sudo sysadminctl -deleteUser paco

This deletes the user and their home directory.

Add a user to the admin group

sudo dseditgroup -o edit -a paco -t user admin

–a paco → add user paco.
admin group → macOS admin privileges.

Remove a user from a group

sudo dseditgroup -o edit -d paco -t user admin

List members of a group

dscl . -read /Groups/admin GroupMembership

If the Mac is joined to Active Directory (AD)

• The local user commands stay the same, but:
  • You don’t create AD users with dscl; those come from the AD server.
  • Group membership changes must be done on the AD domain controller, unless you are adding an AD user to a local Mac group.
• Example: Add an AD user to local admin group:

sudo dseditgroup -o edit -a "ADDOMAIN\\paco" -t user admin

You must use the AD short name and escape the backslash (\\).

Managing Users in macOS using the Terminal

This task is easier than what I expected. So useful to know some Terminal commands. Let me know what you think.

Always contact me if you have any questions. Grab one of my designs in my shop if you like to support me. Thanks!